Re: [Qemu-devel] [PATCH 0/4] net-bridge: rootless bridge support for qemu

[Daniel P. Berrange]

On Thu, Nov 05, 2009 at 04:36:19PM +0200, Avi Kivity wrote:
> On 11/05/2009 04:33 PM, Avi Kivity wrote:
> >and concerned that we're loosening security for qemu non-users.
> >
> 
> I see you've addressed this via an acl system.  Still, this is IMO 
> should be outside qemu, esp. as security is now much more than 
> users/groups (i.e. selinux and friends).

IMHO this needs to hook into PolicyKit, since that is the access control
framework that is being standardized on across the desktop. It is quite
easy to work with - all you need do is provide a policy file, and to
authorize a user, you'd run the 'pkcheck' program and its exit status
gives the result. 

Daniel
-- 
|: Red Hat, Engineering, London   -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org  -o-  http://virt-manager.org  -o-  http://ovirt.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-  F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|